In Configuration > Settings > System > Load Data, the Libraries section is where you connect iManage Work libraries to iManage Threat Manager for threat monitoring, and manage user and group data.

NOTES:

In Libraries, you can:

This section explains how iManage Threat Manager keeps user, group, and library data up to date for accurate monitoring. It covers syncing user and group information from iManage Work and managing libraries to ensure only relevant data is monitored.

In this section:

How user and group processing works across libraries

When libraries in iManage Threat Manager aren’t synchronized, users or groups may have different enablement statuses (enabled, disabled, or deleted) across libraries. To ensure consistent threat monitoring, Threat Manager processes users and groups as follows:

  • If a user or group is enabled in at least one library, it is enabled in Threat Manager.

  • If a user or group is disabled or deleted in all libraries, it remains enabled in Threat Manager.

This behavior applies to both on-premises and cloud deployments, ensuring a unified view of users and groups regardless of library-specific configurations.

Synchronizing user and group data 

To ensure accurate threat monitoring, iManage Threat Manager syncs user and group membership data from iManage Work once a day. To apply recent changes—such as users or groups being added or removed—you can use Sync Users and Groups to trigger an immediate update before the next scheduled sync.

Task: Synchronize user and group data

Use this procedure to immediately sync user and group data from iManage Work.

  1. In Configuration > Settings > System > Load Data, select Sync Users and Groups.

  2. In the confirmation window, select Sync Users and Groups. The sync status appears below the button, for example "Sync pending... Last sync <Date_Time>" where <Date_Time> is the date and time of the previous sync.

NOTE: (On-premises) This process updates user and group data from iManage Work databases to iManage Threat Manager. If new users or groups are added to your organization’s directory service (for example, LDAP/ADS), they must first be synced with iManage Work using your directory sync tool. When available in iManage Work, selecting Sync Users and Groups will make them visible in Threat Manager for threat monitoring.

Working with libraries

A library is a collection of documents and data from an iManage Work database that iManage Threat Manager monitors for potential security threats. Each library represents a specific set of data, such as a project’s files or a department’s records, which Threat Manager loads to analyze user activity and detect risks.

In both on-premises and iManage Cloud deployments, you can add, edit, and remove libraries in Configuration > Settings > System > Load Data section.

  • Adding a library connects it to Threat Manager for monitoring.

  • Editing a library adjusts its settings (for example, the data start date).

  • Removing a library stops monitoring and deletes its activity data, but retains monitoring rules and report data.

You may need to remove a library for several reasons to manage your data effectively:

  • Adjust the data start date: To load data from an earlier date than the library’s fixed start date, remove and re-add the library with a new start date. For example, to include data from February 2024 instead of January 2025, remove and re-add the library.

  • Stop monitoring outdated libraries: Remove libraries with old or irrelevant data, such as those from completed projects, to focus monitoring on active libraries and reduce unnecessary data processing.

  • Fix setup errors: If you added the wrong library or chose incorrect settings, remove and re-add it with the correct configuration. For example, if you mistakenly added a test library, remove it to replace it with the intended library.

  • Streamline monitoring: Removing large or low-priority libraries helps Threat Manager focus on key data, improving efficiency in monitoring and reporting.

  • Meet data policies: To comply with retention or privacy rules (for example, internal policies or regulations like GDPR), remove libraries containing data that should no longer be monitored, such as records past their retention period.

  • Prepare for library transitions: If a library is being retired or moved to a new system, remove it to stop ingestion (data loading) and avoid conflicts during the transition.

  • Reduce unnecessary alerts: Libraries with outdated data may trigger unneeded threat alerts. Removing them improves the accuracy of threat detection.

  • End temporary use: If a library was added for testing or short-term use, remove it after testing to avoid loading unneeded data.